{"id":"CVE-2026-31499","title":"Bluetooth: L2CAP: Fix deadlock in l2cap_conn_del()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn->lock. Ho…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f87271d21dd4ee83857ca11b94e7b4952749bbae < f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da","Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < 3f26ecbd9cde621dd94be7ef252c7210b965a5c7","Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < d008460de352e534f6721de829b093368564ec66","Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < 00fdebbbc557a2fc21321ff2eaa22fd70c078608","Linux efc30877bd4bc85fefe98d80af60fafc86e5775e","Linux 18ab6b6078fa8191ca30a3065d57bf35d5635761","Linux >= 6.12.20 < 6.12.88","Linux >= 6.6.84 < 6.7","Linux >= 6.13.8 < 6.14","Linux 6.14"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:35:51.710580Z"},"published":"2026-04-22","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:45:03.365Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31499","references":[{"url":"https://git.kernel.org/stable/c/f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da"},{"url":"https://git.kernel.org/stable/c/3f26ecbd9cde621dd94be7ef252c7210b965a5c7"},{"url":"https://git.kernel.org/stable/c/d008460de352e534f6721de829b093368564ec66"},{"url":"https://git.kernel.org/stable/c/00fdebbbc557a2fc21321ff2eaa22fd70c078608"}],"tags":["cve.org"],"epss":0.00094,"epssPercentile":0.00583,"ingestedAt":"2026-11-05T23:41:31.981Z","slug":"CVE-2026-31499","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: L2CAP: Fix deadlock in l2cap_conn_del()\n\nl2cap_conn_del() calls cancel_delayed_work_sync() for both info_timer\nand id_addr_timer while holding conn->lock. However, the work functions\nl2cap_info_timeout() and l2cap_conn_update_id_addr() both acquire\nconn->lock, creating a potential AB-BA deadlock if the work is already\nexecuting when l2cap_conn_del() takes the lock.\n\nMove the work cancellations before acquiring conn->lock and use\ndisable_delayed_work_sync() to additionally prevent the works from\nbeing rearmed after cancellation, consistent with the pattern used in\nhci_conn_del().\n\n## Affected\n\n- `Linux >= f87271d21dd4ee83857ca11b94e7b4952749bbae < f7f35a4f7fd574f5889bb2e4b397e14cbb83f6da`\n- `Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < 3f26ecbd9cde621dd94be7ef252c7210b965a5c7`\n- `Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < d008460de352e534f6721de829b093368564ec66`\n- `Linux >= ab4eedb790cae44313759b50fe47da285e2519d5 < 00fdebbbc557a2fc21321ff2eaa22fd70c078608`\n- `Linux efc30877bd4bc85fefe98d80af60fafc86e5775e`\n- `Linux 18ab6b6078fa8191ca30a3065d57bf35d5635761`\n- `Linux >= 6.12.20 < 6.12.88`\n- `Linux >= 6.6.84 < 6.7`\n- `Linux >= 6.13.8 < 6.14`\n- `Linux 6.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}